[PATCH] 248 Restored /etc/pki/pki.conf.
by Endi Sukma Dewata
The /etc/pki/pki.conf has been restored. The upgrade tracker now
will be appended to pki.conf on fresh installation.
--
Endi S. Dewata
11 years, 7 months
AVCs for Dogtag 10.0.2 RA and TPS . . .
by Matthew Harmsen
Ade,
I successfully installed a CA, KRA, OCSP, and TKS using command-line
pkispawn with a configuration file.
Thus far, I have provided a Karma point for TPS and for RA; currently
having trouble with pki-console (due to my X Display not working, not
the package itself).
Once you re-spin pki-core, I can perform a GUI install of these
subsystems and provide a karma point for both pki-coreand
dogtag-pki-theme (once I confirm that console is working).
After this, in order to confirm that dogtag-pki is working, I will need
to remove all of the packages from my system and configure it to point
to the appropriate test repo to make certain that it will grab the
correct versions of Dogtag.
Per your request, here are the TPS and RA AVC's showing up in the
audit.log (I installed the TPS prior to the RA without cleaning the
audit log):*
*
*TPS:*
*# getenforce*
Permissive
*# cat /var/log/audit/audit.log | audit2allow -R*
require {
type httpd_suexec_exec_t;
type pki_tps_t;
class file { read getattr execute };
}
#============= pki_tps_t ==============
allow pki_tps_t httpd_suexec_exec_t:file { read getattr execute };
files_manage_generic_tmp_dirs(pki_tps_t)
files_manage_generic_tmp_files(pki_tps_t)
*RA:*
*# getenforce*
Permissive
*# cat /var/log/audit/audit.log | audit2allow -R*
require {
type pki_tps_t;
type pki_ra_t;
type httpd_suexec_exec_t;
class file { getattr read execute };
}
#============= pki_ra_t ==============
allow pki_ra_t httpd_suexec_exec_t:file { read getattr execute };
files_manage_generic_tmp_dirs(pki_ra_t)
files_manage_generic_tmp_files(pki_ra_t)
#============= pki_tps_t ==============
allow pki_tps_t httpd_suexec_exec_t:file { read getattr execute };
files_manage_generic_tmp_dirs(pki_tps_t)
files_manage_generic_tmp_files(pki_tps_t)
-- Matt
11 years, 7 months
[PATCH] 245 Added upgrade scriptlet to add JNI_JAR_DIR.
by Endi Sukma Dewata
A new upgrade scriptlet has been added to add JNI_JAR_DIR into
pki.conf. The code to manipulate property files has been refactored
from PKIUpgradeTracker into a separate PropertyFile class to allow
reuse.
The pki-base package has been modified to deliver a default pki.conf
in /usr/share/pki/etc and copy it into /etc/pki if it doesn't exist.
--
Endi S. Dewata
11 years, 7 months
[PATCH] 244 Fixed server upgrade problem on new installation.
by Endi Sukma Dewata
The PKIServerUpgrader.get_current_version() incorrectly returns None
if there is no instance on the system. It has been modified to return
the target version so that no upgrade operation will occur.
Bugzilla #957690
--
Endi S. Dewata
11 years, 7 months
[PATCH] 243 Reverting to old CLI behavior on client database initialization.
by Endi Sukma Dewata
Recently the CLI was changed to initialize the default client database
automatically which will create it if it did not exist before. This was
causing a problem since the database was not created with a password.
To create the database properly a separate command is needed. For now
the CLI is reverted to the old behavior where it initializes the
database only if it requires for SSL connection and/or client
authentication.
--
Endi S. Dewata
11 years, 7 months
[PATCH] 242 Added separate CLI option for client database password.
by Endi Sukma Dewata
Previously the -w option is used to specify the password for
either the username/password authentication or client database
password to do client certificate authentication. Since the
passwords now may be used at the same time, a new -c option
has been added for the client database password.
--
Endi S. Dewata
11 years, 7 months
[PATCH] 241 Ignoring warnings/errors during installation.
by Endi Sukma Dewata
The code used by pkispawn and pkidestroy has been modified to ignore
certificate validity warnings/errors that happens during installation.
The instanceCreationMode is now redundant and has been removed from
ClientConfig.
--
Endi S. Dewata
11 years, 7 months